CWE-88 · Argument Injection (page 2)
Page 2 of 5 — CVEs classified under CWE-88, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-26194 | High | 7.3 | 2026-03-05 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlle… |
CVE-2026-20016 | Medium | 6.0 | 2026-03-04 | A vulnerability in the Cisco FXOS Software CLI feature for Cisco Secure Firewall ASA Software and Secure FTD Software could allow an authenticated, local attac… |
CVE-2026-20063 | Medium | 6.0 | 2026-03-04 | A vulnerability in the CLI of Cisco Secure FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating… |
CVE-2026-26514 | High | 7.5 | 2026-03-04 | An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without validation… |
CVE-2026-27947 | High | 8.8 | 2026-02-27 | Group-Office is an enterprise customer relationship management and groupware tool. Versions prior to 26.0.9, 25.0.87, and 6.8.154 have an authenticated Remote… |
CVE-2026-27613 | Critical | 9.8 | 2026-02-25 | TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32. A vulnerability in versions prior to 2.01 allows unauthenticated remote attackers to bypass… |
CVE-2026-27208 | Critical | 9.2 | 2026-02-24 | bleon-ethical/api-gateway-deploy provides API gateway deployment. Version 1.0.0 is vulnerable to an attack chain involving OS Command Injection and Privilege E… |
CVE-2025-70327 | Critical | 9.8 | 2026-02-23 | TOTOLINK X5000R v9.1.0cu_2415_B20250515 contains an argument injection vulnerability in the setDiagnosisCfg handler of the /usr/sbin/lighttpd executable. The i… |
CVE-2026-24126 | Medium | 6.6 | 2026-02-19 | Weblate is a web based localization tool. Prior to 5.16.0, the SSH management console did not validate the passed input while adding the SSH host key, which co… |
CVE-2025-15316 | Medium | 6.7 | 2026-02-09 | Tanium addressed a local privilege escalation vulnerability in Tanium Server. |
CVE-2025-15315 | Medium | 6.7 | 2026-02-09 | Tanium addressed a local privilege escalation vulnerability in Tanium Module Server. |
CVE-2026-25134 | High | 8.8 | 2026-02-02 | Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an… |
CVE-2025-24293 | High | 8.1 | 2026-01-30 | # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation me… |
CVE-2026-24739 | Medium | 6.3 | 2026-01-28 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.51, 6.4.33, 7.3.11, 7.4.5, and 8.0.5, t… |
CVE-2025-61731 | High | 7.8 | 2026-01-28 | Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config… |
CVE-2026-22583 | Critical | 9.8 | 2026-01-24 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (CloudPagesUrl module… |
CVE-2026-22582 | Critical | 9.8 | 2026-01-24 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Salesforce Marketing Cloud Engagement (MicrositeUrl module)… |
CVE-2026-0774 | High | 8.8 | 2026-01-23 | WatchYourLAN Configuration Page Argument Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitra… |
CVE-2026-24061 | Critical | 9.8 | 2026-01-21 | telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable. |
CVE-2025-67858 | | 2026-01-08 | A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impa… | |
CVE-2025-66002 | | 2026-01-08 | An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability allows local users ton perform arbitrary unmounts via smb4… | |
CVE-2025-14946 | Medium | 4.8 | 2025-12-19 | A flaw was found in libnbd. A malicious actor could exploit this by convincing libnbd to open a specially crafted Uniform Resource Identifier (URI). This vulne… |
CVE-2025-68144 | High | 7.1 | 2025-12-17 | In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without s… |
CVE-2025-62847 | High | 7.5 | 2025-12-16 | An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote att… |
CVE-2024-58275 | | 2025-12-04 | Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter in… | |
CVE-2025-12613 | High | 8.6 | 2025-11-10 | Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampers… |
CVE-2025-12556 | High | 8.8 | 2025-11-06 | An argument injection vulnerability exists in the affected product that could allow an attacker to execute arbitrary code within the context of the host machin… |
CVE-2025-36565 | Medium | 6.7 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-43905 | Medium | 4.3 | 2025-10-07 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2025 release version 8.3.1.0… |
CVE-2025-59489 | High | 7.4 | 2025-10-03 | Unity Runtime before 2025-10-02 on Android, Windows, macOS, and Linux allows argument injection that can result in loading of library code from an unintended l… |
CVE-2025-59937 | Critical | 9.1 | 2025-09-29 | go-mail is a comprehensive library for sending mails with Go. In versions 0.7.0 and below, due to incorrect handling of the mail.Address values when a sender-… |
CVE-2025-59433 | Medium | 5.3 | 2025-09-22 | Conventional Changelog generates changelogs and release notes from a project's commit messages and metadata. Prior to version 2.0.0, @conventional-changelog/gi… |
CVE-2025-47421 | | 2025-09-03 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This is… | |
CVE-2025-43730 | High | 8.4 | 2025-08-27 | Dell ThinOS 10, versions prior to 2508_10.0127, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A… |
CVE-2025-57791 | Medium | 6.5 | 2025-08-20 | A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to i… |
CVE-2025-6232 | High | 7.8 | 2025-07-17 | An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated pe… |
CVE-2025-6231 | High | 7.8 | 2025-07-17 | An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated pe… |
CVE-2025-53509 | Medium | 6.5 | 2025-07-11 | A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase(). This issue requires an authenticated at… |
CVE-2025-52459 | Medium | 6.5 | 2025-07-11 | A vulnerability exists in Advantech iView that allows for argument injection in NetworkServlet.backupDatabase(). This issue requires an authenticated attacke… |
CVE-2025-53542 | High | 7.7 | 2025-07-10 | Headlamp is an extensible Kubernetes web UI. A command injection vulnerability was discovered in the codeSign.js script used in the macOS packaging workflow of… |
CVE-2025-46835 | High | 8.5 | 2025-07-10 | Git GUI allows you to use the Git source control management tools via a GUI. When a user clones an untrusted repository and is tricked into editing a file loca… |
CVE-2025-48385 | | 2025-07-08 | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to int… | |
CVE-2025-49520 | High | 8.8 | 2025-06-30 | A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerab… |
CVE-2025-52480 | Critical | 9.8 | 2025-06-25 | Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the cl… |
CVE-2025-3460 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, set_tx_pow, that is vulnerable to command injection. This is an instance of CWE-88, "Improper Ne… |
CVE-2025-3459 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, transmit_file, that is vulnerable to command injection. This is an instance of CWE-88, "Improper… |
CVE-2025-35010 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNPINGTM comman… |
CVE-2025-35009 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MNNETSP command… |
CVE-2025-35008 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MMNAME command… |
CVE-2025-35007 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command… |
CVE-2025-35006 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD comma… |
CVE-2025-35005 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command t… |
CVE-2025-35004 | High | 7.1 | 2025-06-08 | Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command th… |
CVE-2025-32459 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the sync_time argument), that is vulnerable to command injection. This is… |
CVE-2025-32458 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument), that is vulnerable to command injection… |
CVE-2025-32457 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_file_from_qtn argument), that is vulnerable to command injection… |
CVE-2025-32456 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument), that is vulnerable to command injection. Th… |
CVE-2025-32455 | High | 7.7 | 2025-06-08 | The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the run_cmd argument), that is vulnerable to command injection. This is an… |
CVE-2025-49008 | | 2025-06-05 | Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of `escapeshellcmd()` in `/components/code… | |
CVE-2025-3945 | High | 7.2 | 2025-05-22 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterpris… |
CVE-2025-1712 | High | 8.8 | 2025-05-21 | Argument injection in special agent configuration in Checkmk <2.4.0p1, <2.3.0p32, <2.2.0p42 and 2.1.0 allows authenticated attackers to write arbitrary files |
CVE-2025-31499 | High | 8.8 | 2025-04-15 | Jellyfin is an open source self hosted media server. Versions before 10.10.7 are vulnerable to argument injection in FFmpeg. This can be leveraged to possibly… |
CVE-2025-32931 | Critical | 9.1 | 2025-04-14 | DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php a… |
CVE-2024-47516 | Critical | 9.8 | 2025-03-26 | A vulnerability was found in Pagure. An argument injection in Git during retrieval of the repository history leads to remote code execution on the Pagure insta… |
CVE-2025-29768 | Medium | 4.4 | 2025-03-13 | Vim, a text editor, is vulnerable to potential data loss with zip.vim and special crafted zip files in versions prior to 9.1.1198. The impact is medium because… |
CVE-2025-27146 | Low | 2.7 | 2025-02-25 | matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability which can lead to arbit… |
CVE-2025-24845 | Medium | 5.5 | 2025-02-06 | Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If a… |
CVE-2025-0065 | High | 7.8 | 2025-01-28 | Improper Neutralization of Argument Delimiters in the TeamViewer_service.exe component of TeamViewer Clients prior version 15.62 for Windows allows an attacker… |
CVE-2022-31749 | Medium | 6.5 | 2025-01-28 | An argument injection vulnerability in the diagnose and import pac commands in WatchGuard Fireware OS before 12.8.1, 12.1.4, and 12.5.10 allows an authenticate… |
CVE-2025-23073 | Low | 3.5 | 2025-01-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded… |
CVE-2024-9131 | High | 7.2 | 2025-01-10 | A user with administrator privileges can perform command injection |
CVE-2025-21613 | Critical | 9.8 | 2025-01-06 | go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5… |
CVE-2024-51532 | High | 7.1 | 2024-12-19 | Dell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with lo… |
CVE-2024-11633 | Critical | 9.1 | 2024-12-10 | Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code executi… |
CVE-2021-1484 | Medium | 6.5 | 2024-11-15 | A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to inject arbitrary commands on an affected s… |
CVE-2024-39712 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated… |
CVE-2024-39711 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticate… |
CVE-2024-39710 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated… |
CVE-2024-38656 | Critical | 9.1 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated… |
CVE-2024-38655 | High | 7.2 | 2024-11-13 | Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote… |
CVE-2024-52301 | High | 7.5 | 2024-11-12 | Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, th… |
CVE-2024-47553 | Critical | 9.9 | 2024-10-08 | A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate user input to the ``… |
CVE-2024-21533 | Medium | 6.5 | 2024-10-08 | All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL to clone and the fi… |
CVE-2024-20444 | Medium | 5.5 | 2024-10-02 | A vulnerability in Cisco Nexus Dashboard Fabric Controller (NDFC), formerly Cisco Data Center Network Manager (DCNM), could allow an authenticated, remote atta… |
CVE-2024-47611 | | 2024-10-02 | XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows (MinGW-w64 or MSVC), the command line tools… | |
CVE-2024-43402 | High | 8.1 | 2024-09-04 | Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, w… |
CVE-2024-7573 | Medium | 5.3 | 2024-08-28 | The Relevanssi Live Ajax Search plugin for WordPress is vulnerable to argument injection in all versions up to, and including, 2.4. This is due to insufficient… |
CVE-2024-41711 | Medium | 6.8 | 2024-08-13 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could a… |
CVE-2024-41710 | High | 7.2 | 2024-08-12 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could a… |
CVE-2024-39933 | High | 7.7 | 2024-07-04 | Gogs through 0.13.0 allows argument injection during the tagging of a new release. |
CVE-2024-39930 | Critical | 9.9 | 2024-07-04 | The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can… |
CVE-2024-35307 | Critical | 9.8 | 2024-06-10 | Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. Th… |
CVE-2024-2422 | High | 8.8 | 2024-05-30 | LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows… |
CVE-2023-50232 | High | 8.8 | 2024-05-03 | Inductive Automation Ignition getParams Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2023-44452 | High | 7.8 | 2024-05-03 | Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2024-31966 | Medium | 6.2 | 2024-05-02 | A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1… |
CVE-2024-32884 | Medium | 6.4 | 2024-04-26 | gitoxide is a pure Rust implementation of Git. `gix-transport` does not check the username part of a URL for text that the external `ssh` program would interpr… |
CVE-2024-3684 | High | 8.0 | 2024-04-19 | A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console t… |
CVE-2024-32462 | High | 8.4 | 2024-04-18 | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a m… |
CVE-2024-3817 | Critical | 9.8 | 2024-04-17 | HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-g… |